Detections
Analytics
Citrix Hypervisor <= 8.2 LTSR DoS (CTX306565)
high Nessus Plugin ID 148674
Language:
Synopsis
A server virtualization platform installed on the remote host is missing a security patch.Description
The version of Citrix Hypervisor (formerly Citrix XenServer) running on the remote host is missing a security hotfix. It is, therefore, affected by denial of service vulnerabilities.- A local attacker with the ability to execute privileged mode code in a guest machine can perform a denial of service attack against the host causing the host to crash or become unresponsive. Please refer to the vendor advisory for mitigating factors. (CVE-2021-28038)
- A vulnerability was found in openvswitch. A limitation in the implementation of userspace packet parsing can allow a malicious user to send a specially crafted packet causing the resulting megaflow in the kernel to be too wide, potentially causing a denial of service. The highest threat from this vulnerability is to system availability.
(CVE-2020-35498)
- A local attacker with the ability to execute privileged mode code in a guest machine can perform a denial of service attack against the host causing the host to crash or become unresponsive. Please refer to the vendor advisory for mitigating factors. (CVE-2021-28688)
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Apply the appropriate hotfix according to the vendor advisory.See Also
Plugin Details
Severity: High
ID: 148674
File Name: citrix_xenserver_CTX306565.nasl
Version: 1.3
Type: local
Family: Misc.
Published: 4/15/2021
Updated: 4/19/2021
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.2
CVSS v2
Risk Factor: High
Base Score: 7.8
Temporal Score: 5.8
Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:N/A:C
CVSS Score Source: CVE-2020-35498
CVSS v3
Risk Factor: High
Base Score: 7.5
Temporal Score: 6.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:citrix:xenserver
Required KB Items: Host/XenServer/version
Exploit Ease: No known exploits are available
Patch Publication Date: 3/30/2021
Vulnerability Publication Date: 3/30/2021